DEBIAN-CVE-2026-22737

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-22737
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22737.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-22737
Upstream
  • CVE-2026-22737
Published
2026-03-20T00:16:15.837Z
Modified
2026-03-30T14:00:19.204998Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

References

Affected packages

Debian:11 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.3.30-1
4.3.30-2
4.3.30-3
4.3.30-4

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22737.json"

Debian:12 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.3.30-2
4.3.30-3
4.3.30-4

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22737.json"

Debian:13 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.3.30-3
4.3.30-4

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22737.json"

Debian:14 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.3.30-3
4.3.30-4

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22737.json"